facil.io EUVD-2026-47867

The Public Folder Handler feature must be active - this is the specific facil.io capability that routes requests through http_sendfile2 for static file serving; deployments using facil.io purely as an HTTP API framework without static serving enabled are not affected by this code path. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms that beyond this feature being enabled, no authentication, no user interaction, no elevated privileges, and no special network position are required - exploitation is viable against default-configured deployments reachable over the network. Exploitation is limited to file read operations only (VC:L, VI:N, VA:N); the attacker cannot write, delete, or execute files through this vulnerability. The set of readable files is further constrained by the OS-level read permissions of the user account running the facil.io process, so a properly privilege-separated deployment reduces the practical scope of disclosure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) establishes this as a straightforward, unauthenticated, network-reachable read primitive with low confidentiality impact and no integrity or availability consequences. The VC:L rating suggests partial rather than full-system file disclosure, likely bounded by the OS-level read permissions of the facil.io process. A public exploit exists (E:P in the CVSS 4.0 supplemental vector), elevating practical risk above theoretical. No CISA KEV listing means active mass exploitation is not confirmed, but the combination of an unpatched vulnerability, unauthenticated network access, and published PoC is a meaningful real-world risk for any deployment exposing facil.io's static file handler to untrusted networks. EPSS data was not provided; exploitation probability should be treated as moderate given PoC availability. The primary limiting factor is that facil.io is a niche C framework with limited enterprise footprint, which constrains aggregate exposure.

An unauthenticated remote attacker sends an HTTP GET request to a publicly reachable facil.io server containing a traversal payload such as GET /../../../../etc/passwd HTTP/1.1, causing http_sendfile2 to resolve the path outside the configured public folder and return the contents of the targeted file in the HTTP response body. Since a public exploit has been released and the attack requires no authentication or special preconditions, any facil.io instance with the Public Folder Handler exposed to untrusted networks is immediately actionable by a script-kiddie-level adversary.